VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index
CERT/CC details CVE-2026-84286, an out-of-bounds memory access in ExLlamaV3's CUDA extension causing denial-of-service crashes; fixed via merged pull request.
CERT/CC published VU#369611 for CVE-2026-84286, an out-of-bounds memory access in the exllamav3_ext CUDA extension of the ExLlamaV3 LLM inference library. A crafted input with kernel parameter K set to 0 produces a negative index into a fixed 24-entry kernel dispatch array, causing a CUDA illegal memory access and denial-of-service crashes. The vendor fixed the issue in the main repository via pull request #310, and maintainers of 49 downstream projects, including ezexl3 and MawDiscord, are advised to rebuild against the patched version. The issue was reported by Nathan Keys and impact is limited to crashes and instability, not code execution.
- Crafted input with K=0 yields negative index into fixed 24-entry kernel dispatch array
- Impact is denial of service via process crashes; no code execution reported
- 49 downstream projects tracked; ezexl3 and MawDiscord told to rebuild against patched exllamav3_ext
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-84286 | NVD description · AI analysis pending | — | — | — | — | — |
Full article337 words · extracted from kb.cert.org · click to collapse
CERT Coordination Center
ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index
Vulnerability Note VU#369611
Original Release Date: 2026-09-11 | Last Revised: 2026-09-11
Overview
An out-of-bounds (OOB) memory access vulnerability involving unchecked array indexing has been identified in the exllamav3_ext compute unified device architecture (CUDA) extension. Successful exploitation can lead to an immediate denial of service or application instability. This vulnerability is tracked as CVE-2026-84286.
Description
An OOB memory access vulnerability exists in the exllamav3_ext module due to insufficient input validation.
When the kernel parameter K is set to 0 in a crafted input, the extension generates a negative array index, resulting in a CUDA illegal memory access.s. The root cause is a missing bounds check in the kernel-table dispatch process. The checkpoint-derived block index (cbi) is used to access a fixed 24-entry array without confirming that either K or cbi fall within safe limits.
Impact
Primary impacts include Denial of Service (DoS) through process crashes and potential unstable execution states within applications utilizing the library.
Solution
The vendor has addressed this vulnerability in the main repository. Users are advised to update their installations or apply the fix from the merged pull request: https://github.com/turboderp-org/exllamav3/pull/310.
Supply chain
Downstream projects utilizing this library are indirectly exposed to this vulnerability. According to the ExLlamaV3 Dependency Graph, there are 49 total dependencies currently tracking this repository. Notable downstream projects directly affected by this supply chain link include: UnstableLlama / ezexl3 and Ednaordinary / MawDiscord
Developers and maintainers of these dependent repositories are strongly encouraged to rebuild their packages against the patched version of exllamav3_ext.
Acknowledgements
The CERT Coordination Center (CERT/CC) thanks Nathan Keys (professor-moody) for discovering and responsibly reporting this vulnerability.
This AI-assisted vulnerability note was prepared by Laurie Tyzenhaus.
Vendor Information
369611
Filter by status:
Filter by content: Additional information available
Sort by:
Other Information
| CVE IDs: | CVE-2026-84286 |
| API URL: | VINCE JSON | CSAF |
| Date Public: | 2026-09-11 |
| Date First Published: | 2026-09-11 |
| Date Last Updated: | 2026-09-11 20:11 UTC |
| Document Revision: | 1 |
Text extracted automatically; images, tables and formatting may be missing. Original: https://kb.cert.org/vuls/id/369611